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DETAILED ACTION 

Examiner's Amendment 

An examiner's annendnnent to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Dan C. Hu (Reg. No. 40,025) on 4/23/2007. 

This application has been amended as follows: 
IN THE CLAIMS 

Cancel claims 2, 3, 8, 18, 19, 23, 24, 37, 38, 41 - 43 and 45 - 63 without 
prejudice. 

Replace claim 1, 4, 20, 21, 22, 25, 29, 31, 39 and 40 as follows. 
Claim 1 : 

A method for limiting the impact of undesirable behavior of computers on a 
network through which packets of data are interchanged between the computers, 
comprising: 

monitoring the network for any patterns of behavior; 
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determining, upon discovering that one or more of the patterns of behavior is 
undesirable, a type of the undesirable pattern of behavior; 

determining a proper action for mitigating that type of undesirable behavior, the 
proper action including preventing dissemination through the network of packets 
associated with the undesirable behavior and allowing dissemination of packets not 
associated with the undesirable behavior, 

wherein preventing dissemination comprises at least one of changing a routing ^ 
table, changing a fonA/arding table, turning off at least one port of a forwarding device, 
filtering on Internet Protocol (IP) addresses, and filtering on media access control (MAC) 
addresses, and 

wherein a discovery, including that of a network topology, facilitates the network 
monitoring and type of undesirable behavior determination , and 

wherein the dissemination through the network of packets associated with the 
undesirable behavior is prevented for a time period that is lengthened gradually as long 
as the undesirable behavior continues or intermittentiv reappears, the time period being 
gradually shortened if the undesirable behavior stops for a predetermined time . 

Claim 4 : 

The method of claim [[3]] 1, wherein the time period corresponds to a skepticism 
level that depends on a history of the undesirable pattern of behavior, a skepticism level 
zero (0) denoting a good history. 
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Claim 20 : 

The method of claim [[2]] 1, wherein und e rstand i ng discovery of the network 
topology facilitates disablement of ports in forwarding devices that connect to offending 
computers. 

Claim 21 : 

The method of claim [[3]] 1, wherein the time period becomes longer in a random 
exponential backoff before an attempt is made to allow resumption of the packets from 
any offending computer that originated the undesirable pattern of behavior, the time 
period becoming longer if the undesirable pattern of behavior reoccurs during a current 
backoff time, the time period becoming shorter if the undesirable pattern of behavior 
disappears and does not reoccur in the current backoff time. 

Claim 22 : 

A system for limiting the impact of undesirable behavior of computers on a 
network through which packets of data are interchanged between the computers, 
comprising: 

means for monitoring the packets for any patterns of behavior; 

means for determining, upon discovering that one or more of the patterns of 
behavior is undesirable, a type of the undesirable pattern of behavior; 

means for determining a proper action for mitigating that type of undesirable 
behavior, the proper action, performed by mitigation means, including preventing 
dissemination through the network of packets associated with the undesirable behavior 
and allowing dissemination of packets not associated with the undesirable behavior, 
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wherein preventing dissennination comprises at least one of changing a routing 
table, changing a forwarding table, and turning off at least one port of a forwarding 
device, and 

wherein means for discovery, including that of a network topology, facilitates 
network monitoring and type of undesirable behavior determination , and 

wherein the dissemination through the network of packets associated with the 

undesirable behavior is prevented for a time period that is lengthened gradually as long 

as the undesirable behavior continues or intermittently reappears, the time period being 

gradually shortened if the undesirable behavior stops for a predetermined time . 

Claim 25 : 

The system of claim [[24]] 22, wherein the time period corresponds to a 
skepticism level that depends on a history of the undesirable pattern of behavior, a 
skepticism level zero (0) denoting a good history. 

Claim 29 : 

The system of claim 22, wherein preventing the dissemination of packets 
associated with the undesirable pattern of behavior includes discarding the packets 
associated with such behavior, isolating any of the computers at which such behavior 
originates, or isolating any network segments at which such behavior originates. 
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Claim 31 : 

The system of claim [[23]] 22, wherein the undesirable pattern of behavior is a 
broadcast storm, and wherein the monitoring means includes means for learning the 
topology of the network from a fonwarding database or table of a forwarding device In 
the network. 

Claim 39 : 

The m e thod system of claim [[23]] 22, wherein understand i ng discovery of the 
network topology facilitates disablement of ports in forwarding devices that connect to 
offending computers. 

Claim 40 : 

The system of claim [[24]] 22 wherein the time period becomes longer in a 
random exponential backoff before an attempt is made to allow- resumption of the 
packets from any offending computer that originated the undesirable pattern of 
behavior, the time period becoming longer if the undesirable pattern of behavior 
reoccurs during a current backoff time, the time period becoming shorter if the 
undesirable pattern of behavior disappears and does not reoccur in the current backoff 
time. 
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Allowable Subject Matter 

1 . Claims 1 , 4 - 7, 9 - 17, 20 - 22, 25 - 36, 39, 40 and 44 are allowed. 

2. The following is an examiner's statement of reasons for allowance: 

The above mentioned claims are allowable over prior arts because the CPA 
(Cited Prior Art) of record fails to teach or render obvious the claimed limitations in 
combination with the specific added limitations, as recited in independent claims 1,10 
and 16 (& associated dependent claims). 

The prior arts fail to teach or suggest a method for limiting the impact of 
undesirable behavior of computers on a network through which packets of data are 
interchanged between the computers by detemnining a proper action for mitigating the 
type of undesirable behavior, the proper action including preventing dissemination 
through the network of packets associated with the undesirable behavior and allowing 
dissemination of packets not associated with the undesirable behavior, wherein 
preventing dissemination comprises at least one of changing a routing table, changing a 
forwarding table, turning off at least one port of a forwarding device, filtering on Internet 
Protocol (IP) addresses, and filtering on media access control (MAC) addresses, and 
wherein a discovery, including that of a network topology, facilitates the network 
monitoring and type of undesirable behavior determination, and wherein the 
dissemination through the network of packets associated with the undesirable behavior 
is prevented for a time period that is lengthened gradually as long as the undesirable 
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behavior continues or internnittently reappears, the time period being gradually 
shortened if the undesirable behavior stops for a predetermined time. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Longbit Chai whose telephone number is 571-272-3788. 
The examiner can normally be reached on Monday-Friday 8:00am-4:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R Sheikh can be reached on 571-272-3795. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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